Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to get apache to send a 403 instead of a 401 with some config in an .htaccess file? I'm using dreamhost btw.


I should better explain what I am doing. I am doing an HTTP auth login page with jQuery. My goal is to bypass that browser popup login window. To do this, I want the server to give me a 403 error when I try to access a file in the protected realm, as opposed to the 401 I am currently getting by default. When I get that 403, I can run a function that tells the user they have a password wrong instead of that browser popup, which doesn't tell the user they got information wrong, it just makes the site look bad in the end.

thanks =)

share|improve this question

You can use a rewrite rule to produce a 403.

RewriteEngine on
RewriteRule myfile myfile [F]

F, in this case, means forbidden (403).

...and yes, this goes in the .htaccess file.

As described in a comment to radius answer, you'd like to check if a user is authorized. I don't know how you're doing your authorization, but my guess is that it's not immediately possible. I usually do my authorization in PHP, in which case you can simply do a header('HTTP/1.1 403 Forbidden');, but you seem to be using some other mechanism (apache internal I suppose).

share|improve this answer
Yeah I actually am doing auth in apache. But I guess if I could try a PHP based one, and maybe it could send the auth to apache? It's worth a shot. – Kyle Jul 21 '09 at 18:13 seems to do what I want. It doesn't supply that www-authenticate header, which seems to be making the popup come up. – Kyle Jul 21 '09 at 18:16

chmod the file so that it is not readable.

share|improve this answer
is there a way to get the 403 before the 401 though? I am doing a login thing with jquery, and if all the protected files returned 403 then that stupid browser window wouldn't popup. thanks btw! – Kyle Jul 21 '09 at 17:36

Give us more information about what you are doing.
If you have a protected ressource using authentification apache will return code 401. If it returns 403 instead of 401 your browser will not ask you for a password.
If the ressource is not protected by authentification you should not get an error 401.

Edit: As per your edit, I understand that you want http://website/files/forbar to return 403, and have a 403 error page asking for a password (let say http://website/403.php).
I don't think you can do that because your script will not be able to tell apache that the file is no longer forbidden when the user will be logged in.
So you could have the file returning 403 but it will never return something else.

The way I would do is to have 'file' outsite of you public web directory and users to load http://website/myscript.php?getfile=foobar, so that your script can control if user is authenticated or not and give the file when the user will be authenticated.
Of couse you can then add an apache redirection to tell http://website/file/"something" to redirect to http://website/myscript.php?getfile="something" (this one would be RedirectMatch /file/(.*) http://website/myscript.php?getfile=$1

share|improve this answer
actually, 401 (Unautorized) will cause it to ask for password. – falstro Jul 21 '09 at 17:40
Right, sorry I inverted 403 and 401. Now Corrected. – radius Jul 21 '09 at 17:59
I'm trying to do HTTP auth in jQuery. I am going to do this by checking if a user is already logged in ( get a file in the protected realm, if it returns a 403, it could run a function that tells the user they were wrong as opposed to that window popping up) – Kyle Jul 21 '09 at 17:59
Ooooooooh! @Kyle, update your question, I don't think anyone got that. – falstro Jul 21 '09 at 18:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.